test runner: web runner mutates live application.wheels — replace global swap with request-scoped overlay

[bpamiri]

Context

Phase 2 of the subfolder-deployment work (discussion #2887, issue #2968, PR #2985). The runtime subpath setting shipped in #2985; this issue tracks the test-runner half — the reporter's headline pain point ("the application scope hacks break the main application, which a reload=true fixes. They seem to fight each other").

Problem

The web test runner swaps the live application configuration globally, in place, for the duration of a test request:

• vendor/wheels/tests/runner.cfm:36-38 — backs up application.wheels to application.$$$wheels, then mutates the live application.wheels that every concurrent request reads.
• vendor/wheels/tests/runner.cfm:286-287 — restores and deletes the backup at end-of-response.
• vendor/wheels/Global.cfc:4068 $restoreTestRunnerApplicationScope() + the hooks in events/EventMethods.cfc:4,305 and the flag at events/init/views.cfm:41 exist precisely because this swap can be left half-applied (aborts, errors, timeouts) — the recovery hook is an admission of the fragility, not a fix for it.
• Legacy twin: vendor/wheels/rocketunit_tests/Test.cfc:8,33-34.

Consequences:

• Any real traffic hitting the app while a test request is in flight executes against test configuration (test datasource, test routes).
• A failed restore leaves the app broken until ?reload=true — the exact "they fight each other" symptom from Running Wheels 4 in a subfolder - And figuring out tests (broken) #2887.
• Subfolder deployments don't cause this; they just make it easier to trip over (per-app paths make a stale restore more visible).

Proposed direction

Replace the global swap with a request-scoped overlay: resolve the effective config per request (e.g. a request.wheels.configOverlay consulted by the config readers, or a composed view over the application struct) so test requests see test config while concurrent requests keep seeing live config, and there is nothing to restore — the overlay dies with the request.

Cross-engine cautions (this touches the hottest config-read paths):

• Config reads happen everywhere; the overlay check must be near-free on the non-test path.
• No function members on application scope (Adobe), no closures capturing this across scopes — see CLAUDE.md Cross-Engine Invariants.
• The $restoreTestRunnerApplicationScope() machinery and application.$$$wheels become removable once the overlay lands — delete them in the same PR so the old path can't half-engage.

Acceptance

• A test request running concurrently with a normal request never changes what the normal request reads.
• Killing a test request mid-run (abort/timeout) requires no recovery hook and no reload=true.
• /wheels/app/tests works under a subpath-mounted app (ties back to Running Wheels 4 in a subfolder - And figuring out tests (broken) #2887's setup).
• The $$$wheels backup/restore and recovery hooks are removed.

Refs #2887. Follow-up to #2985 (phase 1).

[bpamiri]

Folding in the remaining small item from #2887 so it isn't lost — the reporter's point 1:

• Harden the app-template public/Application.cfc root anchor: this.wheels.rootPath = getDirectoryFromPath(getBaseTemplatePath()) mis-anchors when the base template isn't the front controller (the tests bootstrap under a subfolder). Reporter's working tweak: derive from getCurrentTemplatePath() + getCanonicalPath(dir & "../"). Same bootstrap surface as the overlay work, so it rides along here.

[wheels-bot]

Wheels Bot — Triage

Classified as bug.

The web test runner swaps the live application configuration globally, in place. vendor/wheels/tests/runner.cfm:36-38 backs up application.wheels to application.$$$wheels and then mutates the live application.wheels that every concurrent request reads; runner.cfm:286-287 restores it at end-of-response. The existence of $restoreTestRunnerApplicationScope() (vendor/wheels/Global.cfc:4068) plus the hooks in events/EventMethods.cfc and the flag in events/init/views.cfm confirm this swap can be left half-applied (aborts, errors, timeouts), leaving the app broken until ?reload=true — the reproducible "they fight each other" symptom. A normal request landing while a test request is in flight executing against test datasource/routes is observable wrong behavior reproducible in isolation, independent of the proposed redesign.

Suspected layer

config — see .ai/wheels/cross-engine-compatibility.md (there is no .ai/wheels/config/; the center of gravity for the fix is per-request config resolution and the hot config-read paths, plus the test infra in vendor/wheels/tests/ and .ai/wheels/testing/).

Fix sketch

Likely touches vendor/wheels/tests/runner.cfm (the swap/restore), the config readers that consult application.wheels, vendor/wheels/Global.cfc ($restoreTestRunnerApplicationScope()), events/EventMethods.cfc, events/init/views.cfm, and the legacy twin vendor/wheels/rocketunit_tests/Test.cfc. Shape: introduce a request-scoped config overlay (e.g. request.wheels.configOverlay) so test requests see test config while concurrent requests keep live config, with the overlay check near-free on the non-test path; then delete the $$$wheels backup/restore and recovery hooks so the old path cannot half-engage. This is not a one-file mechanical change.

Confidence: low

The report is detailed and unambiguous, but the fix is a multi-file architectural overlay touching the hottest config-read paths with explicit cross-engine cautions (Adobe application-scope member-function ban, closure this-capture, per-request cost) — the cross-engine auto-downgrade caps this at medium, and the non-mechanical, design-heavy fix shape drops it to low so it stays manual rather than auto-firing propose-fix.

<!-- wheels-bot:triage:3025 -->
<!-- wheels-bot:triage-class:bug -->

[bpamiri]

Design pass — reuse the multi-tenant request-scoped overlay, don't invent a new one

Verified the current state against develop: the global swap (runner.cfm:36-38 backup → 54-111 mutate → 304-305 restore) and the fragility machinery it forces ($restoreTestRunnerApplicationScope() at Global.cfc:4296, hooks at EventMethods.cfc:4,350, flag at views.cfm:41) are all still present. The bug is real and current.

But a key finding reframes the work: the request-scoped config overlay this issue asks for already exists — it's the multi-tenant system — and the naive "consult request.wheels.configOverlay in the config readers" framing under-weights three things.

Why a $get()-only overlay is not enough

1. Most config bypasses the chokepoint. $get() (Global.cfc:677-689) already consults a request-scoped overlay (the request.wheels.tenant.config check — line-for-line the proposed pattern). But config is read directly as application.wheels.X in ~2,263 sites — 305 for dataSourceName alone — versus ~440 get() calls. An overlay consulted only by $get() is invisible to the direct reads that actually route queries, so test queries would not redirect.

2. Models bake their datasource at creation, not per-query: variables.wheels.class.datasource (model/miscellaneous.cfc:20). That is exactly why the runner also does StructClear(application.wheels.models) (runner.cfm:106) — to force re-creation against the swapped datasource. You cannot clear the global model cache per-request without corrupting concurrent requests. This is the hard part.

3. The ~20 swapped keys are not homogeneous and need different handling (see tiers below).

The prior art to build on: the tenant overlay

The multi-tenant system already solves the concurrency-safe per-request datasource problem with no global swap and no model-cache clear:

• $tenantDataSource() (Global.cfc:745) returns request.wheels.tenant.dataSource per request, falling back to $get("dataSourceName").
• The adapter consults this at query time, so models route to the per-request datasource without re-creation.
• sharedModel (Model.cfc:109) lets specific models opt out of the override.

This is the request-scoped, concurrency-safe overlay the issue wants — already shipped and cross-engine-verified. The design should model the test environment as a request-scoped overlay that reuses this machinery (effectively a "test tenant"), not build a parallel overlay.

Proposed design — three setting tiers

Split the ~20 swapped keys by how they are read, and handle each tier with an existing mechanism:

Tier A — datasource (dataSourceName, coreTestDataSourceName, model cache). Reuse the tenant datasource path. Set request.wheels.tenant.dataSource (or a dedicated request.wheels.testDataSource consulted by the same adapter resolver) for the test request. Adapter-level resolution removes the need for both the application.wheels.dataSourceName swap and the StructClear(models) — models keep their identity; only the resolved datasource changes per request. This is the load-bearing win.

Tier B — simple flags read through $get() (automaticValidations, transactionMode, cacheQueriesDuringRequest, assetQueryString, assetPaths, migrationLevel, functions.redirectTo.delay, the csrf* knobs). Put these in a request.wheels.configOverlay consulted by the existing $get() overlay branch (same precedence/security-denylist treatment the tenant overlay already has). Audit each for direct application.wheels.X reads on the test path; route the few that bypass $get() through it. The non-test path adds at most one StructKeyExists(request.wheels, "configOverlay") — near-free.

Tier C — routes. If test routes are needed, resolve them request-scoped too rather than swapping application.wheels.routes; otherwise confirm the runner doesn't actually need a route swap and drop it.

Removal (same PR)

Once Tier A+B land: delete application.$$$wheels backup/restore (runner.cfm:36-38, 304-305), $restoreTestRunnerApplicationScope() (Global.cfc:4296), the EventMethods.cfc:4,350 hooks, and the views.cfm:41 flag — so the old half-applying path cannot re-engage. Legacy twin rocketunit_tests/Test.cfc:8,33-34 too.

Cross-engine gates

• Overlay check must be near-free on the non-test path (single StructKeyExists), matching the tenant overlay's cost.
• No function members on application scope (Adobe — Invariant 2); no closures capturing this across scopes; no reserved-scope param names. The overlay is data-only, copy-then-read.
• Prove on Lucee 6/7, Adobe 2018–2025, BoxLang via tools/test-matrix.sh.

Acceptance (unchanged) + suggested staging

1. Stage 1: Tier A — request-scoped test datasource via the tenant resolver path; remove the dataSourceName swap + StructClear(models). Pin with a concurrency spec: a test request and a normal request in flight read different datasources.
2. Stage 2: Tier B + C — overlay the remaining flags via $get(); audit/route direct readers on the test path.
3. Stage 3: delete $$$wheels + recovery hooks + legacy twin; verify killing a test request mid-run needs no reload=true.
4. /wheels/app/tests under a subpath-mounted app (Running Wheels 4 in a subfolder - And figuring out tests (broken) #2887).

Separable companion item

The folded-in Application.cfc rootPath anchor fix (getCurrentTemplatePath() + canonicalize, replacing getDirectoryFromPath(getBaseTemplatePath())) is template-only and independent of the overlay — it can ship on its own and is validatable via the onboarding harness.

---

Net: this is a design-pass refactor (the low triage confidence is right), but the hardest half — concurrency-safe per-request datasource — is already solved by the tenant system, so the realistic path is to reuse it rather than build a new overlay.

[bpamiri]

Adversarial feasibility analysis — superseding the design comment above

After posting the plan above, I ran a complete adversarial analysis (10 dimensions, each attacked then independently re-verified against the code, plus completeness/blast-radius/alternative-design critics). It reverses the central premise of my earlier comment. Posting the result in full; where the original plan or my first findings overstated something, the verification corrected it (noted below for fair credit).

Adversarial Feasibility Analysis — Issue #3025 Request-Scoped Test-Config Overlay

1. Executive Verdict

The plan is NOT feasible as written — it is a BLOCKER. Its central premise — reuse the multi-tenant overlay so models "route per-request WITHOUT StructClear(models)" (Tier A) — is structurally false for the test runner's primary use case. The multi-tenant override at databaseAdapters/Base.cfc:820-827 swaps only the datasource NAME string inside $performQuery, after the SQL has already been generated by a dialect adapter object that is baked per model class at init (Model.cfc:107) from a globally-read datasource (Model.cfc:43) and cached app-scoped (Global.cfc:1324, Model.cfc:466). The runner exists to test against a different DB engine than the dev app (SQLite/H2 dev vs MySQL/Postgres/MSSQL/Oracle/CockroachDB in CI — runner.cfm:89-98), the exact inverse of the multi-tenant invariant (same engine, different physical DB). A request-scoped name override cannot change the dialect SQL (LIMIT vs TOP, "id" vs [id], NEWID()), the frozen column schema (Model.cfc:114-323), or the automaticValidations-gated ruleset (Model.cfc:46). The runner's own comment documents this precisely: StructClear(application.wheels.models) exists because a model cached from a prior datasource "retain[s] the wrong adapter when testing against a different database" (runner.cfm:101-106). The single hardest blocker: the plan deletes StructClear(models) without replacing what it accomplishes (cross-engine dialect/schema re-baking), and that re-baking is structurally incompatible with the app-scoped, bare-name-keyed model cache the plan must keep for concurrency. Secondary independent blockers: the swapped flags are read by direct application.wheels.X access (not $get), so the overlay reaches almost none of them; routes/paths have no tenant dimension to reuse; and browser/parallel tests depend on the global swap they would lose.

2. Per-Dimension Verdicts

Dimension	Verdict	One-line reason
Concurrency correctness	Conditional	Tier A name-swap can't carry dialect/schema/CSRF/routes/paths; destructive DDL + application.testenv live outside the overlay.
Cross-engine dialect	Blocker	Dialect adapter baked per-class at init; name override fires only in $performQuery, never re-bakes SQL/schema.
Flag-overlay reach	Blocker	Only assetQueryString/assetPaths are $get-clean; transactionMode half-overlaid, automaticValidations class-baked, redirectTo.delay structurally unreachable.
Model-cache identity	Blocker	Cache keyed by bare name, app-scoped; no per-request namespace — a concurrent normal request always shares the test request's cached class.
Request-scoped routes (Tier C)	Conditional	Routes/staticRoutes/namedRoutePositions swapped globally, no tenant route hook; static fast-path reads app scope directly; ~23-spec migration.
Removal safety	Conditional	Deletion is reference-clean but mis-attributes hooks (they protect a different runner) and omits a third runner + two unguarded call sites.
Overlay lifecycle / thread-safety	Conditional (leans blocker)	Request-scope is per-thread (criterion 1 holds for $get paths), but failure flips from crash-loud to silent-wrong.
CFML traps + hot-path cost	Blocker	Tier A dialect-blind + Tier B premise false; compounds the #2897 $get hot-path optimization.
Transaction & migration semantics	Blocker	transactionMode read as arg-default global expr (9 sites); migrator + ~50 populate.cfm DDL sites read dataSourceName/migrationLevel directly, never reaching the override.
Architecture / alternatives	Conditional	Tier A premise unsound; two stronger steelmen (separate app context; concurrency guard) unevaluated.

3. Blockers (highest severity first)

B1 — Tier A swaps only the datasource name; it cannot re-bind the dialect adapter (cross-engine = wrong SQL)

• databaseAdapters/Base.cfc:820-827 sets ONLY arguments.dataSource from request.wheels.tenant.dataSource; the adapter object that built the SQL is untouched.
• Model.cfc:43 bakes class.dataSource = application.wheels.dataSourceName at init; Model.cfc:107 bakes the adapter object; Model.cfc:373-397,466-477 memoize it in application.wheels.adapterCache by datasource NAME.
• Dialect divergence is real: SQLiteModel.cfc:148-150 double-quotes identifiers; MicrosoftSQLServerModel.cfc:341-343 brackets [name], :333-335 NEWID(), :110 SELECT TOP n.
• The SQL is fully built before Base.cfc:826 overrides the name, so a name swap only changes which connection executes already-wrong-dialect SQL. Making Tier A correct requires per-request adapter re-resolution — which writes the GLOBAL adapterName/adapterCache (Model.cfc:385/470), re-introducing the criterion-1 leak one layer down. runner.cfm:101-106 exists precisely to re-bake the adapter via StructClear(models).

B2 — Column schema and automaticValidations are frozen into the cached class at init

• Model.cfc:114-117,163-209,320-323 populate class.properties/types from adapter.$getColumns() against the baked datasource at init; Base.cfc:112,415-444 key the schema cache off the adapter's baked variables.dataSource, NOT the request override — so even schema reads ignore the per-request datasource.
• Model.cfc:46 reads automaticValidations directly (not $get) at init; a $get overlay can't intercept it, and it only affects a fresh bake — never a cached class shared with a concurrent request.

B3 — Model cache is app-scoped, keyed by bare name; no per-request identity

• Global.cfc:1324 (application.wheels.models[name], bare-name key), :1311-1334 (modelPath swapped globally at runner.cfm:48-51), :1392-1406/:1006-1015 (model() returns the app-cached class to ANY caller). Acceptance criterion 1 is always false for any model name shared between app and test — both contend for the same slot. The plan adds no per-request namespace.

B4 — Tier B's "few that bypass $get" is a large direct-read surface

• $get-clean: only assetQueryString (view/assets.cfc:276), assetPaths (:297).
• transactionMode — half-overlaid: $get at create.cfc:23,87+bulk.cfc:20,85, but DIRECT at delete.cfc:29,103,140,181 (4) and update.cfc:33,163,199,240,275 (5); several are function-arg-default expressions that can't route through $get without signature changes.
• cacheQueriesDuringRequest direct at read.cfc:307; migrationLevel at Migrator.cfc:418,553,894 (application[appKey], never even application.wheels); functions.redirectTo.delay structurally unreachable ($args reads application.wheels.functions[] at Global.cfc:2908-2909; the overlay branch is guarded by !Len(functionName) at :678); CSRF reads ~15+ direct in controller/csrf.cfc:149-301, zero $get.
• The plan's named request.wheels.configOverlay key does not exist today; converting ~24+ sites compounds the Per-request / per-row mixin re-integration and reflective dispatch tax on the hottest framework paths #2897 $get hot-path optimization (Global.cfc:674-676).

B5 — Migrator and populate.cfm issue destructive DDL against the shared datasource, outside any overlay

• runner.cfm:108-116 → populate.cfm:112 DROP TABLE …, ~26 CREATE TABLE c_o_r_e_* + seeds, ~50 cfquery/cfdbinfo hardcoding datasource="#application.wheels.dataSourceName#"; runner.cfm:95-98 points populate at the real DB in single-DB dev. Migrator.cfc queries read application[appKey].dataSourceName directly via $query, never $performQuery. Schema/data corruption of the shared physical DB is unaddressed; criterion 1 is necessary but not sufficient.

B6 — Browser/parallel tests DEPEND on the global swap (the inverse of criterion 1)

• wheelstest/BrowserTest.cfc:303 drives real HTTP against the running server; ParallelRunner.cfc:188-199 issues fresh top-level cfhttp GETs that re-enter runner.cfm with their own request.wheels. runner.cfm:42-51 swaps controllerPath/viewPath/modelPath/rewriteFile so fixtures are served to ANY inbound request. A request-scoped overlay lives only in the runner request's scope; an independent browser request gets a fresh scope and resolves real app config → fixtures 404 / wrong DB. The plan never mentions browser tests.

B7 — The multi-tenant machinery being "reused" already abandoned request-scoping for migrator work

• migrator/TenantMigrator.cfc:144-169 swaps application[appKey].dataSourceName under an exclusive lock, with a comment that the migrator "reads application.wheels.dataSourceName lazily at query time, so the application-wide datasource is swapped … for the whole action." The canonical reuse target concluded the request override was insufficient for exactly the migrator/$dbinfo operation class the runner performs.

B8 — Routes/paths have no tenant dimension; the static fast-path reads app scope directly

• runner.cfm:42-43 rewrites application.wheels.routes/namedRoutePositions; Mapper.cfc:249-281 writes app scope and clears application.urlForCache. Dispatch.cfc:204-216 reads application.wheels.staticRoutes directly (not the parameterized arg); Global.cfc:1534-1560 reads namedRoutePositions/routes directly. grep tenant.routes → ZERO. ~23 spec files read these directly (e.g. BrowserLoginAsHandlerSpec.cfc:26,41 iterates application.wheels.routes). Tier C is net-new dispatch-hot-path code + a large spec migration, no machinery to reuse.

B9 — Unaddressed global path swaps

• runner.cfm:47-51 repoints five paths. viewPath IS read via $get (can ride Tier B), but modelPath is a direct default at Global.cfc:1313, rewriteFile at :1915, and the model bakes modelPath at creation — so fixture models still can't resolve without StructClear(models), undercutting Tier A again.

4. What the Plan Got RIGHT (vindicated) + Explicitly REFUTED (fair credit)

Vindicated: request scope IS per-thread, so criterion 1 genuinely holds for any $get-routed setting; the overlay guards fail open (degrade to app config, no crash); assetQueryString/assetPaths already work as assumed; the deletion list is reference-clean (onAbort sites are StructKeyExists-guarded no-ops); simple-value overlay is cross-engine-safe (runner copies only booleans/strings); the legacy rocketunit_tests/Test.cfc twin is orphaned and deletable; Tier C is genuinely necessary (the runner does swap routes).

Refuted / corrected (the plan & my first pass get credit):

• "The $get denylist blocks the runner's CSRF keys" — REFUTED. ListFindNoCase is whole-token; csrfCookieEncryptionSecretKey ≠ encryptionSecretKey. The real obstacle is that CSRF reads bypass $get entirely (B4), not the denylist.
• The runner swaps three CSRF keys, not four (csrfCookieEncryptionAlgorithm left at default). Swapped set = 10 flat flags + dataSourceName.
• The CSRF write-back (csrf.cfc:159) is gated by if (!Len(...)) and does NOT fire in the test path.
• automaticValidations is a direct read (Model.cfc:46), not $get — which strengthens the blocker.
• Count corrections (don't change verdicts): non-test dataSourceName reads ≈ 30 (not 305 — that was the all-files total); cacheQueriesDuringRequest has 1 non-test direct read (not 14); the testRunnerApplicationScope setter is Test.cfc:494, not the rocketunit twin.

5. Revised Feasibility & Rescoping

The full three-tier overlay cannot ship as specified. Verified blast radius ≈ 60–110 edited call sites across Migrator.cfc, migrator/{Base,TenantMigrator}.cfc, Model.cfc, model/{create,update,delete,bulk,read}.cfc, Controller.cfc, controller/{rendering,layouts,processing,csrf}.cfc, Dispatch.cfc, Mapper.cfc, Global.cfc, plus a new request-scoped routing+paths subsystem and 3 shipped scaffold/example templates — against the plan's "reuse existing machinery, few sites" framing.

Minimal feasible Stage 1 — a concurrency GUARD, not an overlay. A test-run flag is already set at the top of every test request (request.$wheelsTestRun; flash.cfc:225-226 $inTestHarness) and the endpoint dispatches through the controller layer (Public.cfc:455-459, dev-only). An exclusive lock (or reject/serialize) around the whole swap→run→restore window makes "concurrent normal request reads test config" structurally impossible — satisfying criterion 1 at a fraction of the surface, without touching the model cache, dialect, routes, or paths, and without breaking browser tests. This is exactly what TenantMigrator.cfc:158-169 already does for the analogous migrator case. Pair it with: reconcile the two recovery mechanisms (runner.cfm's application.$$$wheels is a different chain than $restoreTestRunnerApplicationScope, which reads request.wheels.testRunnerApplicationScope set only by the CLI $wheelsRunner at Test.cfc:493-494 and protects the legacy path, NOT runner.cfm); delete the orphaned rocketunit_tests/Test.cfc twin.

Superior alternative (auditor-judged): a separate application context / datasource isolation is the strongest steelman and is already half the design — tests point at dedicated wheelstestdb_* datasources and the runner is reached through normal dispatch. A separate app context yields a separate application.wheels, separate model cache (correct dialect, no StructClear), separate routes/paths — sidestepping B1–B3, B8, B9 at once while keeping the in-flight server serving test config (so browser tests still work).

6. "What Would Have to Be True" for the Full Overlay

1. A per-(model, datasource) adapter strategy, OR a model cache keyed/namespaced by datasource (today: baked Model.cfc:107, keyed by name Global.cfc:1324; override is name-only Base.cfc:826).
2. A request-scoped model namespace so a concurrent request and the test request never share a cached class (B3).
3. Per-request schema (class.properties) re-resolution (today frozen at init, Model.cfc:114-323, Base.cfc:415-444).
4. Migrate ~24+ direct flag reads through $get, convert the function-arg-default transactionMode reads (signature changes), re-architect $args (Global.cfc:2908) and the class-init automaticValidations read — without regressing the Per-request / per-row mixin re-integration and reflective dispatch tax on the hottest framework paths #2897 $get hot-path cost.
5. A request-scoped routing+path subsystem covering routes/staticRoutes/namedRoutePositions + the static fast-path (Dispatch.cfc:204-216) + modelPath/rewriteFile, plus migrating ~23 specs that read these directly.
6. Isolation of the destructive populate.cfm/migrator DDL (B5), and a decision for the migrator/$dbinfo phase the tenant system itself handles via global-swap-under-lock (B7).
7. A browser/parallel-test plan (B6) — keep a global swap for that subset, or thread the overlay across the HTTP boundary.
8. Reconciliation of application.testenv (runner.cfm:108, cleared by neither restore) and the CSRF cookie write (runner.cfm:83-88).
9. Removal-scope expansion: also $wheelsRunner (Test.cfc:483-494), public/views/tests.cfm, the Public.cfc:412-419 rocketunit branch, the two UNGUARDED call sites (EventMethods.cfc:4,350), the onAbort hook in shipped templates (cli/lucli/templates/app/public/Application.cfc, examples/{tweet,starter-app}/public/Application.cfc) — criterion 4 is fully met only for freshly-scaffolded apps; existing user apps keep a guarded probe forever.

---

Bottom line: pursue the concurrency guard for the real near-term win (satisfies criterion 1 without the impossible Tier-A re-bake), and treat true cross-engine isolation as a separate-application-context effort rather than a request-scoped config overlay. The original "reuse the tenant overlay" framing should be retired.